Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FFmpeg to Google: Fund us or stop sending bugs

thenewstack.io

Post reply on HN
Print view View original

771–780 of 913 posts

Re: FFmpeg to Google: Fund us or stop sending bugs

#771

Post by surajrmal »

woodruffw wrote: post #10

I’m an open source maintainer, so I empathize with the sentiment that large companies appear to produce labor for unpaid maintainers by disclosing security issues. But appearance is operative: a security issue is something that I (as the maintainer) would need to fix regardless of who reports it, or would otherwise need to accept the reputational hit that comes with not triaging security reports. That’s sometimes per…

I wonder if language plays a large role in the burden imposed on the maintainers.

Re: FFmpeg to Google: Fund us or stop sending bugs

#772

Post by NoGravitas »

kome wrote: post #563
PeaceTed wrote: post #145

Earlier quoted context omitted.

I love the spirit of working for free on a project of passion. But yes it only takes a few bad actors to totally exploit it.

use GPL

AGPL at a minimum. Some kind of copyfarleft license if a corporation exploiting your code is a serious concern.

Re: FFmpeg to Google: Fund us or stop sending bugs

#773

Post by h14h »

Should Google be doing more to support ffmpeg? Yes.

Should Google stop devoting resources to identifying and reporting security vulnerabilities in ffmpeg?

I cannot bring myself to a mindset where my answer to this question is also "yes".

It would be one thing if Google were pressuring the ffmpeg maintainers in their prioritization decisions, but as far as I can tell, Google is essentially just disclosing that this vulnerability exists?

Maybe the CVE process carries prioritization implications I don't fully understand. Eager to be educated if that is the case.

Re: FFmpeg to Google: Fund us or stop sending bugs

#774

Post by Wowfunhappy »

tpmoney wrote: post #346
Wowfunhappy wrote: post #318

Earlier quoted context omitted.

Ffmpeg makes it trivial to enable and disable individual codecs at compile time. Perhaps it's the Linux distros that need to make a change here?

I get that the ffmpeg people have limited time and resources, I get that it would be nice if Google (or literally anyone else) patched this themselves and submitted that upstream. But "everyone else down stream of us should compile out our security hole" is a terrible way to go about things. If this is so obscure of a bug that there's no real risk, then there's no need for anyone to worry that the bug has been report…

Here’s where I’m coming from: it would really suck if the outcome of all this was for ffmpeg to drop support for niche codecs.

It may be the case that ffmpeg cannot reasonably support every format while maintaining the same level of security. In that case, it makes sense for distros to disable some formats by default. I still think it’s great that they’re supported by the ffmpeg project.

I agree there would probably need to be some unified guidance about which formats to enable.

Re: FFmpeg to Google: Fund us or stop sending bugs

#775

Post by NoGravitas »

ganelonhb wrote: post #6

Not too fond of maintainers getting too uppity about this stuff. I get that it can be frustrating to receive bug report after bug report from people who are unwilling or unable to contribute to the code base, or at the very least to donate to the team. But the way I see it, a bug report is a bug report, no matter how small or big the bug or the team, it should be addressed. I don’t know, I’m not exactly a pillar of t…

> Not too fond of maintainers getting too uppity about this stuff.

I suppose you'd prefer they abandon their projects entirely? Because that's the real alternative at this point.

Re: FFmpeg to Google: Fund us or stop sending bugs

#776

Post by samus »

chii wrote: post #676
samus wrote: post #617

Earlier quoted context omitted.

They are different because the independent researchers don't make money off the projects that they investigate.

> independent researchers don't make money off the projects that they investigate but they make money off the reputational increase they earn for having their name attached to the investigation. Unless the investigation and report is anonymous and their name not attached (which, could be true for some researchers), i can say that they're not doing charity.

That's a one-time bonus they get for discovering a bug, not from using the project on production. Google also gets this reward by the way. Therefore it's still imbalanced.

Re: FFmpeg to Google: Fund us or stop sending bugs

#778

Post by ndriscoll »

f33d5173 wrote: post #523
ndriscoll wrote: post #344

Earlier quoted context omitted.

The ffmpeg authors aren't "shipping" anything; they're giving away something they make as a hobby with an explicit disclaimer of any kind of fitness for purpose. If someone needs something else, they can pay an engineer to make it for them.

This has nothing to do with payment. Not deliberately infecting your users with vulnerabilities is simply the right thing to do. Giving something away for free doesn't absolve you of certain basic ethical responsibilities.

They're not deliberately infecting users with anything. There effectively saying "here's example code showing how to deal with these video formats. NOTE THAT THESE ARE EXAMPLES THAT I WROTE FOR FUN. THEY ARE NOT MEANT FOR SERIOUS USE AND MAY NOT HANDLE ALL CORNER CASES SAFELY. THIS SHOULD BE OBVIOUS SINCE WE HAVE NO COMMERCIAL RELATIONSHIP AND YOU'RE DOWNLOADING RANDOM CODE FROM SOMEONE YOU DON'T KNOW ON THE INTERNET".

If someone goes on to use that code for serious purposes, that's on them. They were explicitly warned that this is not production commercial code. It's weekend hobby work. There's no ethical obligation to make your hobby code suitable for production use before you share it. People are allowed to write and share programs for fun.

Deliberate malware would be something like an inbuilt trojan that exfiltrates data (e.g. many commercial applications). Completely different.

Re: FFmpeg to Google: Fund us or stop sending bugs

#779

Post by samus »

Dylan16807 wrote: post #642
samus wrote: post #617

Earlier quoted context omitted.

They are different because the independent researchers don't make money off the projects that they investigate.

Google makes money off ffmpeg in general but not this part of the code. They're not getting someone else to write a patch that helps them make money, because google will just disable this codec if it wasn't already disabled in their builds. Also in general Google does investigate software they don't make money off.

> Also in general Google does investigate software they don't make money off.

An organization of this size might actually have trouble making sure they really don't use code from that project. Or won't do so in the future.

Re: FFmpeg to Google: Fund us or stop sending bugs

#780

Post by samus »

surajrmal wrote: post #750
kierank wrote: post #660

Earlier quoted context omitted.

FFmpeg is developed almost entirely by volunteers. We have no "customers".

There are people who use and depend on ffmpeg. Maintainers seem to go out of their way to solve issues these folks face. If you don't care, then ignore the bug reports and force them to solve their own problems by contributing.

These people are not customers though. The maintainers do their best, but overall the project seems to be understaffed though, so customers (for example Google, as it seems they occasionally chip in) get priority.
Post reply on HN